← Back to issue list

build(autogen): bump dependencies to resolve OSVs

View original Github issue

Metadata

Project
imagecraft
Number
#247
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

Merged after passing CI and receiving two approvals. Updated filelock, fonttools, and urllib3 to resolve OSV security warnings. An unrelated Spread test failure was noted but did not block the merge.

Suggested action: —

No scores available.

Issue body

Bumps dependencies to resolve some OSV warnings. ``` ❯ uv lock -P urllib3 -P fonttools -P filelock Resolved 170 packages in 1.68s Updated filelock v3.19.1 -> v3.20.2 Updated fonttools v4.60.1 -> v4.61.1 Updated urllib3 v2.5.0 -> v2.6.2 ``` --- - [ ] I've followed the [contribution guidelines](https://github.com/canonical/imagecraft/blob/main/CONTRIBUTING.md). - [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [ ] I've successfully run `make lint && make test`. - [ ] I've added or updated any relevant documentation.

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.6-35b-a3b — — Merged after passing CI and receiving two approvals. Updated filelock, fonttools, and urllib3 to resolve OSV security warnings. An unrelated Spread test failure was noted but did not block the merge.
qwen3.6-35b-a3b-mtp-q6 — — Merged dependency updates for filelock, fonttools, and urllib3 to resolve OSV security warnings. An unrelated spread test issue was noted during review but did not block the merge.
qwen3.6-35b-a3b-mtp-q6 — — Merged updates for filelock, fonttools, and urllib3 to resolve OSV security warnings. An unrelated Spread test failure was noted but did not block the merge.

Update history

No update history recorded yet.

Related issues

Issue Project State Summary Similarity
#342 build(autogen): bump libraries to fix OSVs craft-store merged Merged dependency updates for cffi, filelock, jaraco-context, protobuf, pynacl, urllib3, and wheel to resolve OSV security vulnerabilities. Approved by two reviewers and passed all CI checks.
84%
#457 build(autogen): bump dependencies craft-cli merged Merged after reviewer approval and passing all CI checks. Bumped dependencies across two files to resolve multiple OSV security vulnerabilities. All tests, linting, and security scans passed successfully.
84%
#5871 build(autogen): bump pip for OSV snapcraft merged Merged after three approvals. Bumps pip to 25.3 to resolve OSV vulnerability GHSA-4xh5-x5gv-qwph. All required CI checks passed prior to merge.
80%
#1000 build: update dependencies to resolve OSVs craft-providers closed Merged and closed to resolve OSVs by updating dependencies and security scan calling conventions. Passed CI checks with no comments or reviewer feedback.
78%
#963 build(deps): update lockfile for OSVs craft-providers merged Merged after two approvals. Updated lockfile via uv lock on cryptography, idna, pytest, and urllib3 to fix OSV CI. Approved and passed checks.
78%
#143 build(deps): resolve OSVs debcraft merged Resolved OSV security vulnerabilities by updating idna to v3.18 and urllib3 to v2.7.0. Approved by a reviewer, passed all CI checks, and merged.
76%
#180 build(deps): resolve OSVs craft-grammar merged Merged following two approvals and successful CI checks. Updated pytest from v9.0.2 to v9.0.3 to resolve OSV security vulnerabilities across one dependency file.
76%
#131 build(deps): resolve OSVs debcraft merged Merged dependency updates to resolve OSV vulnerabilities. Updated cryptography, pygments, pytest, requests, and craft-parts via uv lock. Approved by two reviewers with all CI checks passing. Changes accepted despite minor pinning discussions.
76%
#230 build(autogen): bump starlette for OSV imagecraft merged Merged to bump the Starlette dependency, resolving an OSV security warning. Approved by two reviewers, passed all CI checks, and updated the lock file with a minimal version change.
75%
#1121 build: bump requests to avoid OSV craft-parts merged Merged after bumping the requests dependency to resolve an OSV vulnerability. Approved by two reviewers with all CI checks passing. The update modifies three files with 136 additions and 10 deletions.
75%